Skip to content

ci(GitHub): Bump step-security/harden-runner from 0c6ab70129fa3660acd9cd2b51e8685d619cd613 to d7cf128fba8343bb6666acf77451879c0530cac8 #653

ci(GitHub): Bump step-security/harden-runner from 0c6ab70129fa3660acd9cd2b51e8685d619cd613 to d7cf128fba8343bb6666acf77451879c0530cac8

ci(GitHub): Bump step-security/harden-runner from 0c6ab70129fa3660acd9cd2b51e8685d619cd613 to d7cf128fba8343bb6666acf77451879c0530cac8 #653

Workflow file for this run

name: Build
on:
pull_request:
paths-ignore:
- '**-check.yml'
- '**-submission.yml'
- '**-validation.yml'
- '**.*ignore'
- '**.md'
- '**.txt'
- '**benchmark.yml'
- '**dependabot.yml'
push:
paths-ignore:
- '**-check.yml'
- '**-submission.yml'
- '**-validation.yml'
- '**.*ignore'
- '**.md'
- '**.txt'
- '**benchmark.yml'
- '**dependabot.yml'
env:
CI: true
BUILD_NUMBER: ${{ github.run_number }}
SCM_TAG: ${{ github.sha }}
GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
GRADLE_OPTS: "\
-Dorg.gradle.configuration-cache=false \
-Dorg.gradle.vfs.watch=false \
-Dorg.gradle.unsafe.watch-fs=false \
"
jobs:
os-checks:
strategy:
fail-fast: false
matrix:
java: [ '17' ]
os: [ 'macos-latest', 'windows-latest', 'ubuntu-latest' ]
name: 'Test on ${{ matrix.os }} JDK ${{ matrix.java }}'
timeout-minutes: 55
runs-on: ${{ matrix.os }}
if: ${{ !contains(github.event.head_commit.message, 'ci skip') }}
steps:
- name: Harden Runner
if: matrix.os == 'ubuntu-latest'
uses: step-security/harden-runner@d7cf128fba8343bb6666acf77451879c0530cac8
with:
disable-sudo: true
egress-policy: audit
- name: Checkout
uses: actions/checkout@v4
- name: 'Set up JDK ${{ matrix.java }}'
uses: actions/setup-java@v3
with:
distribution: 'temurin'
java-version: '${{ matrix.java }}'
- name: 'Set up NodeJS 18 (LTS)'
if: matrix.os != 'windows-latest'
uses: actions/setup-node@v3
with:
node-version: 18
- name: 'Cache Konan (Kotlin/Native compiler)'
timeout-minutes: 6
uses: actions/cache@v3
continue-on-error: true
with:
path: |
~/.konan
/Users/runner/.konan
key: ${{ runner.os }}-konan-${{ hashFiles('**/*.versions.toml') }}
restore-keys: |
${{ runner.os }}-konan-${{ hashFiles('**/*.versions.toml') }}
${{ runner.os }}-konan-
- name: Setup Gradle
uses: gradle/gradle-build-action@v2
with:
gradle-home-cache-cleanup: true
cache-read-only: ${{ (github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev') || matrix.java != '17' }}
- name: 'Build and check on ${{ matrix.os }} (complete, non-release)'
id: check
if: matrix.os != 'windows-latest'
timeout-minutes: 50
run: ./gradlew build assemble check --stacktrace --continue --scan
- name: 'Build and check on ${{ matrix.os }} (split_targets, release)'
if: matrix.os == 'windows-latest'
timeout-minutes: 35
env:
RELEASE: true
run: ./gradlew build assemble check -Dsplit_targets --stacktrace --continue --scan --no-daemon
- name: "Add build scan URL as PR comment"
uses: actions/github-script@v6
if: github.event_name == 'pull_request' && failure()
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: '❌ ${{ github.workflow }} failed: ${{ steps.gradle.outputs.build-scan-url }}'
})
- name: Summary
if: success() || failure()
continue-on-error: true
run: ./.github/workflows/summary.main.kts >> $GITHUB_STEP_SUMMARY
shell: bash
- name: Upload code coverage
if: (success() || failure()) && !contains(github.event.head_commit.message, 'coverage skip')
uses: codecov/codecov-action@v3
env:
OS: ${{ matrix.os }}
JAVA_VERSION: ${{ matrix.java }}
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: ./build/reports/kover-merged-report.xml
env_vars: OS,JAVA_VERSION
flags: 'unit-tests,${{ matrix.os }}'
name: 'codecov-${{ matrix.os }}'
move_coverage_to_trash: true
fail_ci_if_error: false
- name: Upload reports
if: success() || failure()
uses: actions/upload-artifact@v3
continue-on-error: true
with:
name: 'reports-${{ matrix.os }}'
path: |
**/build/reports/
!**/build/reports/configuration-cache/
!**/build/reports/dependency-analysis/
- name: Upload merged sarif (Lint)
if: (success() || failure()) && matrix.os == 'macos-latest'
&& (github.event_name == 'pull_request' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
uses: github/codeql-action/upload-sarif@v2
continue-on-error: true
with:
sarif_file: build/lint-merged.sarif
category: lint
- name: Upload merged sarif (Detekt)
if: (success() || failure()) && matrix.os == 'macos-latest'
&& (github.event_name == 'pull_request' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
uses: github/codeql-action/upload-sarif@v2
continue-on-error: true
with:
sarif_file: build/detekt-merged.sarif
category: detekt
- name: Publish JUnit test results as a pull request check
if: (success() || failure()) && matrix.os == 'macos-latest'
&& github.repository == 'fluxo-kt/fluxo' && github.ref == 'refs/heads/main'
uses: mikepenz/action-junit-report@v4
with:
report_paths: '**/build/test-results/*/TEST-*.xml'
- name: 'Check release API and publish SNAPSHOT'
id: snapshot
if: matrix.os == 'macos-latest' && matrix.java == '17'
&& steps.check.outcome == 'success'
&& github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'fluxo-kt/fluxo'
env:
OSSRH_USER: ${{ secrets.OSSRH_USER }}
OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
RELEASE: true
run: ./gradlew apiCheck androidApiCheck publish -DDISABLE_TESTS --rerun-tasks --stacktrace --scan
- name: 'Check release API on ${{ matrix.os }}'
if: matrix.os != 'windows-latest' && steps.snapshot.outcome == 'skipped'
env:
RELEASE: true
run: ./gradlew apiCheck androidApiCheck --stacktrace --scan